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The  City  Services  Auditor  was  created  within  the  Controller’s  Office  through  an  amendment  to  the 
City  Charter  that  was  approved  by  voters  in  November  2003.  Under  Appendix  F to  the  City  Charter, 
the  City  Services  Auditor  has  broad  authority  for: 

• Reporting  on  the  level  and  effectiveness  of  San  Francisco’s  public  services  and 
benchmarking  the  city  to  other  public  agencies  and  jurisdictions. 

• Conducting  financial  and  performance  audits  of  city  departments,  contractors,  and  functions 
to  assess  efficiency  and  effectiveness  of  processes  and  services. 

• Operating  a whistleblower  hotline  and  website  and  investigating  reports  of  waste,  fraud,  and 
abuse  of  city  resources. 

• Ensuring  the  financial  integrity  and  improving  the  overall  performance  and  efficiency  of  city 
government. 

The  audits  unit  conducts  financial  audits,  attestation  engagements,  and  performance  audits.  Financial 
audits  address  the  financial  integrity  of  both  city  departments  and  contractors  and  provide  reasonable 
assurance  about  whether  financial  statements  are  presented  fairly  in  all  material  aspects  in 
conformity  with  generally  accepted  accounting  principles.  Attestation  engagements  examine,  review, 
or  perform  procedures  on  a broad  range  of  subjects  such  as  internal  controls;  compliance  with 
requirements  of  specified  laws,  regulations,  rules,  contracts,  or  grants;  and  the  reliability  of 
performance  measures.  Performance  audits  focus  primarily  on  assessment  of  city  services  and 
processes,  providing  recommendations  to  improve  department  operations. 

We  conduct  our  audits  in  accordance  with  the  Government  Auditing  Standards  published  by  the  U.S. 
Government  Accountability  Office  (GAO).  These  standards  require: 

• Independence  of  audit  staff  and  the  audit  organization. 

• Objectivity  of  the  auditors  performing  the  work. 

• Competent  staff,  including  continuing  professional  education. 

• Quality  control  procedures  to  provide  reasonable  assurance  of  compliance  with  the  auditing 
standards. 
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San  Francisco  Airport  Commission 
P.O.  Box  8097 

San  Francisco  International  Airport 
San  Francisco,  CA  94128 

President  and  Members: 

The  Controller’s  Office,  City  Services  Auditor,  presents  its  report  concerning  the  cash  handling 
audit  of  the  Security  Access  Office  (SAO)  at  San  Francisco  International  Airport  (Airport).  The 
SAO  is  responsible  for  issuing  and  managing  airport  identification  (ID)  badges,  security  keys, 
and  vehicle  permits;  conducting  security  and  safety  training;  and  issuing  film,  free  speech  booth, 
and  Berman  Reflection  Room  permits. 

Audit  Period:  May  6,  2008,  through  April  21 , 2009 

Results:  The  SAO: 

• Deposited  all  cash  received. 

• Did  not  have  appropriate  internal  controls  to  ensure  that  all  cash  is  accounted  for. 

• Did  not  always  deposit  cash  promptly. 

The  audit  includes  14  recommendations  for  improving  SAO’s  cash  handling  procedures.  The 
Airport’s  response  to  the  audit  is  attached  as  Appendix  A.  The  Controller’s  Office,  City  Services 
Auditor,  will  follow  up  with  the  Airport  on  the  status  of  the  recommendations  made  in  this  report. 

Respectfully  submitted, 


Tonia  Lediju 
Director  of  Audits 


cc:  Mayor 

Board  of  Supervisors 
Budget  Analyst 
Civil  Grand  Jury 
Public  Library 


415-554-7500 


City  Hall  ■ 1 Dr.  Carlton  B.  Goodlett  Place  • Room  316  • San  Francisco  CA  94102-4694 


FAX  415-554-7466 
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INTRODUCTION 


Audit  Authority 


Background 


The  City  Charter  provides  the  Controller,  City  Services 
Auditor  (CSA),  with  broad  authority  to  conduct  audits.  This 
audit  was  conducted  under  that  authority  and  pursuant  to 
an  audit  plan  agreed  to  by  the  Controller  and  the  Airport. 

The  Airport  Security  Access  Office  (SAO)  is  responsible  for 
issuing  and  managing  identification  badges,  security  keys, 
and  vehicle  permits;  conducting  security  and  safety  training; 
and  issuing  film,  free  speech  booth,  and  Berman  Reflection 
Room  permits1  at  San  Francisco  International  Airport 
(Airport).  The  SAO  has  two  locations,  a main  office  and  the 
Annex,  and  has  annual  receipts  of  approximately  $490,000. 
Of  that  amount,  the  Annex  receives  approximately  $46,000, 
or  9 percent.  Both  the  main  office  and  the  Annex  are 
currently  located  on  the  same  floor  of  Terminal  1 . 

The  Airport  allows  various  types  of  payment  for  its  security 
access  services:  cash,  check,  credit  card,  draw-down 
(prepaid)  accounts,  and  customer  billing.  Draw-down 
accounts  and  customer  billing  services  are  options  for 
customers  who  have  an  ongoing  relationship  with  the 
Airport;  these  types  of  accounts  are  co-managed  by  the 
Airport  Accounting  unit.  Airport  Accounting  is  responsible 
for  payments  received  through  a lock  box.  For  customers 
paying  onsite,  the  main  office  accepts  cash,  check,  and 
credit  card  payments  for  all  services;  the  Annex  does  not 
accept  credit  cards  and  provides  limited  services. 

SAO  uses  three  systems  to  manage  its  customer  accounts: 

• Monitor  Dynamic  Inc.  (MDI) 

• Property  Management  Billing  System  (PMBS) 

• Cash  receipt  books 

These  systems  do  not  interface.  The  MDI  is  used  to 
manually  verify  that  customers  have  met  all  criteria  required 
for  issuing  a permit  or  badge,  but  does  not  track  payments 
or  daily  transactions.  The  PMBS  system  is  an  airport-wide 
billing  system  managed  by  Airport  Accounting,  and  is 
reconciled  to  an  SAO  spreadsheet  used  to  track 
transactions  for  customers  using  billing  services.  Cash 


The  free  speech  booth  and  the  Berman  Reflection  Room  are  spaces  available  for  rent. 


receipt  books  are  used  to  track  all  customers  paying  with 
cash,  check,  or  credit  card  at  the  main  office,  and  cash  and 
check  at  the  Annex. 


Objectives,  Scope  and 
Methodology 


SAO  is  in  the  process  of  acquiring  a point-of-sale  (POS) 
system  and  anticipates  transitioning  to  the  new  system  by 
the  end  of  calendar  year  2009.  According  to  the  SAO 
manager,  the  new  system  will  interface  with  Airport 
Accounting  and  the  PMBS  system. 

The  purpose  of  this  audit  was  to  determine  if  the  SAO  has 
adequate  controls  to  ensure  that  all  payments  received  are 
deposited  and  that  all  cash  deposits  are  complete, 
accurate,  and  timely.  The  auditors  reviewed  cash  payments 
received  in  the  SAO  main  office  and  Annex  from  May  6, 
2008,  through  April  21, 2009. 

To  conduct  the  audit,  the  audit  team: 

• Reviewed  SAO’s  cash  handling  controls  through  direct 
observation,  a questionnaire,  and  interviews  of  SAO 
management,  employees,  and  Airport  Accounting  staff. 

• Collected  all  daily  tally  sheets  and  summarized  them  by 
the  individuals  handling  cash. 

• Reviewed  gaps  in  the  numbered  receipts  in  the  SAO’s 
records  and  tested  those  gaps.  This  test  was  based  on  a 
judgmental  sample  of  32  gaps  in  receipt  serial  number 
sequences  missing  from  the  cashier’s  tally  sheets. 

• Tested  a sample  of  15  voided  transactions  for  proper 
authorization. 

• Tested  the  accuracy  and  completeness  of  SAO’s  cash 
deposits.  The  auditors  reviewed  24  sample  days, 
including  the  10  days  with  the  highest  daily  collections,  8 
days  with  the  lowest  daily  collections,  and  6 randomly 
chosen  days  to  verify  that  all  cash  was  accounted  for. 
The  auditors  checked  that  the  receipt  books  matched  the 
daily  total  sheets,  the  bank  deposit  slips,  the  bank 
statements,  and  the  revenue  recorded  in  FAMIS,  the  City 
and  County  of  San  Francisco’s  accounting  system. 

• Tested  a sample  of  24  deposits  to  determine  whether 
they  were  deposited  within  one  business  day. 


This  audit  did  not  review  payments  received  through  Airport 
Accounting,  which  are  subject  to  greater  system  oversight. 
Due  to  SAO  system  limitations,  the  auditors  were  unable  to 
confirm  that  all  transactions  were  recorded  in  SAO’s  receipt 
books. 

This  performance  audit  was  conducted  in  accordance  with 
generally  accepted  government  auditing  standards.  These 
standards  require  planning  and  performing  the  audit  to 
obtain  sufficient,  appropriate  evidence  to  provide  a 
reasonable  basis  for  the  findings  and  conclusions  based  on 
the  audit  objectives.  The  auditors  believe  that  the  evidence 
obtained  provides  a reasonable  basis  for  the  findings  and 
conclusions  based  on  the  audit  objectives. 
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AUDIT  RESULTS 


The  SAO  Deposited 
All  Cash  Received 


SAO  Does  Not  Have 
Appropriate  Controls 
to  Ensure  That  All 
Cash  is  Accounted 
For 


SAO  has  weak 
segregation  of  duties 


Out  of  a sample  of  24  days  tested,  the  auditors  found  that  the 
cash  recorded  in  SAO’s  receipt  books  matched  the  amount 
deposited  into  the  bank.  All  cash  receipts  were  deposited. 

Although  all  cash  was  accounted  for,  the  auditors  found  that 
this  was  not  due  to  an  effective  control  structure  over  the  cash 
handling  process.  The  SAO  does  not  have  appropriate  controls 
to  ensure  that  all  cash  is  secure  and  accounted  for.  The  SAO 
needs  to  strengthen  segregation  of  duties  and  its  controls  over 
record  keeping,  authorization,  asset  custody,  and 
reconciliation.  When  strong  financial  controls  are  in  place,  theft 
or  errors  may  be  prevented  or  discovered  early  when  the 
dollars  involved  are  minor. 

The  SAO  has  weak  segregation  of  duties.  Segregation  of  cash 
handling  duties  is  a fundamental  control  for  organizations  that 
collect  cash.  Segregation  of  duties  involves  separating  the 
responsibility  for  the  following  tasks:  receiving  cash,  preparing 
deposits,  depositing  cash,  recording  deposits  to  the  general 
ledger,  and  reconciling  cash.  This  division  of  duties  helps 
create  a structure  that  makes  it  harder  for  accounting  errors  or 
theft  to  go  undetected.  It  provides  a system  of  checks  and 
balances  that  helps  ensure  all  cash  is  properly  accounted  for. 

The  SAO  has  weak  segregation  of  duties  because  one 
employee  is  primarily  responsible  for  receiving  cash,  preparing 
the  deposit,  reconciling  receipts  to  the  deposit,  and  depositing 
the  cash.  Exhibit  1 shows  the  SAO’s  current  segregation  of 
duties  and  Exhibit  2 provides  an  example  of  how  duties  can  be 
segregated  to  strengthen  cash  handling  controls. 
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EXHIBIT  1 


SAP’s  Current  Segregation  of  Duties 


Role 

Handling 

Cash 

Preparing 

Deposit 

Reconciling 
Receipts  to 
Deposit 

Recording 
Deposit  to 
GL 

Making 

Cash 

Deposit 

Comparing 
Deposits  to 
GL  Entries 

Cashier 

X 

X 

X 

X 

Clerks  (1-9) 

X 

Management 
Assistants  (1-3) 

X 

Secretary 

X 

Airport  Account 
Clerk 

X 

Airport  Principal 
Accountant 

X 

Source:  Auditor  analysis  of  information  provided  by  the  SAO. 


EXHIBIT  2 


Example  of  Appropriate  Segregation  of  Duties 


Role 

Handling 

Cash 

Preparing 

Deposit 

Reconciling 
Receipts  to 
Deposit 

Recording 
Deposit  to 
GL 

Making 

Cash 

Deposit 

Comparing 
Deposits  to 
GL  Entries 

Individual  1 

X 

X 

Individual  2 

X 

X 

Individual  3 

X 

X 

X 

Source:  Auditor  analysis  of  best  practices. 


On  a monthly  basis,  an  Airport  accountant  independently 
compares  the  SAO’s  deposits,  which  are  recorded  in  FAMIS,  to 
the  bank  statements.  Having  Airport  Accounting  record 
deposits  to  the  general  ledger  and  reconcile  the  general  ledger 
to  the  bank  statements  is  a good  cash  handling  control. 
However,  greater  segregation  of  duties  is  needed.  By  assigning 
a cashier  to  perform  the  majority  of  the  key  cash  handling 
functions,  including  approving  her  own  reconciliations  and 
deposits,  the  SAO  has  created  a situation  in  which  errors  or 
fraud  could  go  undetected. 


SAO  Needs  to 
Strengthen  Its 
Controls  Over  Record 
Keeping, 

Authorization,  Asset 
Custody,  and 
Reconciliation 


Record  Keeping 

Controls  over  cash 
receipts 


Controls  over  daily  tally 
sheets 


Authorization 

Controls  over  cash 
deposits 


The  SAO  also  has  weak  controls  over  four  key  cash  handling 

functions: 

• Recording  keeping:  the  creation  and  maintenance  of 
records. 

• Asset  custody:  the  physical  safekeeping  of  cash. 

• Authorization:  the  review  and  approval  of  transactions. 

• Reconciliation:  the  assurance  that  all  cash  is  accounted  for. 

• The  SAO  did  not  always  record  key  information  on  its 
receipts,  such  as  the  type  of  service  provided,  the  quantity 
of  services  (e.g.,  number  of  badges  issued),  and  the 
company  receiving  the  service.  This  makes  it  difficult  for 
SAO  management  to  verify  that  the  amount  charged  is 
correct. 

• Based  on  the  SAO’s  daily  tally  sheets,  the  auditors 
originally  found  that  there  were  a significant  number  of 
gaps  in  the  numbered  receipts  in  the  SAO’s  receipt  book. 
Further  testing  found  that  no  receipts  were  actually  missing 
but  that  23  out  of  32  receipt  gaps  were  due  to  receipt 
numbers  that  were  incorrectly  recorded  in  SAO’s  tally 
sheets.  Such  errors  increase  the  difficulty  for  SAO 
management  to  ensure  that  all  receipts  and  cash  have 
been  included  in  the  daily  total. 

• Cash  deposits  are  not  reviewed  for  accuracy  or  approved 
by  a second  individual. 

• The  individual  preparing  the  deposit  uses  the  manager’s 
signature  stamp  to  sign  off  that  the  deposit  is  correct. 
However,  the  manager  does  not  actually  review  the 
deposit. 

• A test  of  1 5 voided  transactions  found  that  SAO  employees 
void  transactions  without  documenting  the  reason  for  the 
void.  Recording  the  reason  for  each  void  helps 
management  ensure  that  all  voided  transactions  are  valid. 
In  addition,  a test  of  the  same  15  transactions  found  that 
employees  did  not  obtain  management’s  review  and 
approval.  There  are  no  mitigating  controls  to  deter  an 
employee  from  voiding  a transaction  and  pocketing  the 
cash. 
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Asset  Custody 


Controls  over  cash 


Reconciliation 

Controls  over  receipt 
books 


• Fourteen  SAO  employees  (74  percent  of  all  SAO  staff) 
handled  cash  transactions  and  had  access  to  the  cash 
drawer  during  the  audit  period.  The  14  individuals  included 
the  cashier,  a secretary,  3 management  assistants,  and  9 
clerks.  However,  only  6 of  those  individuals  handled  greater 
than  five  percent  of  the  total  cash  received.  The  more 
people  who  have  access  to  the  cash  drawer  and  cash 
records,  the  weaker  the  security  over  the  cash.  If  a theft  did 
occur,  it  would  be  difficult  to  determine  the  responsible 
individual. 

• In  one  instance,  the  auditors  observed  that  cash  was  left 
unattended  on  the  cashier’s  desk  while  she  issued  a receipt 
to  a customer.  Although  the  cashier’s  desk  is  not 
accessible  to  the  public,  cash  should  never  be  left 
unattended. 

• The  SAO  does  not  perform  periodic  cash  counts.  Periodic 
surprise  cash  counts  confirm  the  accuracy  of  the  cash 
balance  in  the  cash  drawer,  and  help  discourage 
employees  from  removing  cash  from  the  drawer  for 
unauthorized  reasons. 

• Safe  keys  are  not  changed  upon  the  transfer  or  termination 
of  key  employees  with  access  to  the  safe.  Changing  the 
safe  keys  periodically  reduces  the  risk  of  unauthorized 
access. 

• Although  the  Annex  location  only  takes  in  a relatively  small 
amount  of  cash,  the  Annex  lacks  minimal  cash  handling 
controls  or  oversight.  This  makes  it  difficult  to  ensure  that 
all  transactions  are  reported.  In  addition,  they  do  not  have  a 
sign  posted  at  the  Annex  with  the  schedule  of  fees.  This 
would  increase  the  likelihood  of  overcharging  customers 
and  pocketing  the  difference. 

• Although  Airport  Accounting  issues  pre-numbered  receipt 
books,  neither  Airport  Accounting  nor  the  SAO  reconcile 
receipt  numbers  to  ensure  that  all  receipts  are  accounted 
for. 


Controls  over  reporting 


SAO  Did  Not  Always 
Deposit  Its  Cash 
Promptly 


Recommendations 


• The  SAO’s  automated  systems  are  unable  to  generate 
reports  capable  of  reconciling  cash  received  (e.g.,  daily 
total  amount,  number  of  daily  transactions,  etc).  Without  a 
system  that  can  generate  reports  to  reconcile  to  the  cash 
received,  the  SAO  must  rely  on  other  controls  to  ensure  the 
accuracy  of  cash  totals.  As  discussed  in  this  report,  the 
SAO  has  minimal  controls  over  the  cash  handling  process. 

Daily  bank  deposits  should  be  made  to  reduce  the  amount  of 
excess  cash  kept  in  the  SAO  offices.  Eleven  out  of  the  24  daily 
collections  tested  (46  percent)  were  not  deposited  within  one 
business  day.  Of  these  deposits,  8 were  deposited  one  day 
late,  1 was  deposited  two  days  late,  and  2 were  deposited 
three  days  late.  According  to  the  SAO,  one  reason  this  may 
occur  is  because  the  cashier  does  not  have  a back-up  when 
she  is  out  or  when  she  is  too  busy  to  make  the  deposits. 

To  strengthen  its  controls  over  the  cash  handling  process,  the 
SAO  should: 

1 . Establish  written  policies  and  procedures  to  clarify  the 
SAO’s  approved  cash  handling  process. 

2.  Further  segregate  the  key  cash  handling  duties  among 
designated  SAO  employees. 

3.  Work  with  Airport  Accounting  to  ensure  that  there  is 
oversight  over  the  use  of  its  pre-numbered  receipts. 
Specifically,  ensure  that  all  transactions  have  an  approved, 
current  receipt  number  and  that  all  pre-numbered  receipts 
are  accounted  for. 

4.  Strengthen  its  controls  over  voided  transactions  by 
requiring  that  employees  document  the  reason  for  each 
void  and  obtain  a manager’s  approval. 

5.  Designate  a second  individual  to  review  and  approve  the 
daily  reconciliation  and  daily  deposit. 

6.  Not  allow  employees  to  use  the  manager’s  signature 
stamp. 

7.  Review  which  employees  should  have  access  to  the  cash 
drawer  and  receipt  books  and  consider  limiting  employees’ 
access. 


8.  Ensure  that  cash  is  never  left  unsecured  on  a desktop. 

9.  Periodically  perform  a surprise  cash  count  of  the  cash 
drawer. 

10.  Change  the  keys  to  the  safe  when  employees  with  safe 
access  leave  employment  with  the  SAO. 

1 1 . Post  a fee  schedule  at  the  Annex. 

12.  Post  signs  notifying  customers  that  they  should  be  issued  a 
receipt  for  their  transaction. 

13.  Ensure  that  cash  is  deposited  within  one  business  day. 

14.  When  the  point-of-sale  system  is  implemented,  balance  the 
daily  amount  received  to  the  number  of  transactions 
processed  to  the  total  cash  received. 
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ATTACHMENT  A:  AIRPORT’S  RESPONSE 


December  7,  2009 


S.U1  rr.mci\co 

w uvi  aji  mho 
fa  i, war i joos 


Ms.  Tonia  l.cdiju 
Director  of  Audits 
City  & County  of  San  Francisco 
Office  of  the  Controller 
City  Services  Auditor  Division 
San  Francisco,  CA  94102 

SUBJECT:  Audit  and  Recommendation  and  Response  Form 

Cash  Handling  Audit  of  (he  Security  Access  Office  (SAO) 

Dear  Ms.  Lediju: 

As  requested,  attached  please  find  the  completed  Audit  Recommendation  and  Response 
Form  for  the  San  Francisco  International  Airport’s  Security  Access  Office  (SAO).  Thts 
form  summarizes  and  acknowledges  the  Airport’s  response  to  the  Cash  Handling  Audit 
of  the  SAO. 

ij'.MXMtMi  If  you  have  any  questions,  please  feel  free  to  contact  me  at  (650)  821-5010  or  Ms.  Kim 

.i  Dickie,  Assistant  Deputy  Airport  Director.  Aviation  Security  at  (650)  821-3925. 

Thank  you. 

Sincerely, 

T ryg  McCoy 
Deputy  Airport  Director 
Operations  and  Security 

Attachment 

cc:  Kim  Dickie 


A-1 


